Is Apache Tomcat 8.5.100 patched?
Current stable (11.0.27): 100/100
8.5.100 has 16 open critical-or-high vulnerabilities. Run 9.0.121 or later to clear them. See what 9.0.121 fixes →
Summary iPlain-English security status for Apache Tomcat 8.5.100, built from its CVEs, active-exploitation data, end-of-life date and latest release.
Apache Tomcat 8.5.100 is part of the 8.5 release line. 21 known vulnerabilities affect it. The minimum safe version is 9.0.121 — upgrade to it or later to clear the open critical/high issues. The 8.5 line reached end-of-life on 2024-03-31, so it no longer receives security patches. The latest supported Apache Tomcat release is 11.0.27.
Known issues affecting 8.5.100
Exploited first, then by exploitation probability.
CVE-2025-55752 HIGH EPSS 64% → fixed in 11.0.11 CVE-2025-55754 CRITICAL EPSS 10% → fixed in 11.0.11 CVE-2026-29146 HIGH EPSS 6% → fixed in 11.0.20 CVE-2025-61795 MEDIUM EPSS 1% → fixed in 11.0.12 CVE-2020-8022 HIGH EPSS 1% → fixed in 9.0.35-3.57.3 CVE-2026-65905 CRITICAL EPSS 1% → fixed in 11.0.25 CVE-2026-68763 HIGH EPSS 1% → fixed in 11.0.25 CVE-2026-68525 CRITICAL EPSS 1% → fixed in 11.0.25 CVE-2026-68569 HIGH EPSS 1% → fixed in 11.0.25 CVE-2026-65927 HIGH EPSS 1% → fixed in 11.0.25 CVE-2026-65182 CRITICAL EPSS 0% → fixed in 11.0.25 CVE-2026-66422 HIGH EPSS 0% → fixed in 11.0.25 CVE-2026-55276 CRITICAL EPSS 0% → fixed in 11.0.23 CVE-2026-55955 MEDIUM EPSS 0% → fixed in 11.0.23 CVE-2026-73180 MEDIUM EPSS 0% → fixed in 11.0.25 CVE-2026-55957 HIGH EPSS 0% → fixed in 11.0.5 CVE-2026-53404 HIGH EPSS 0% → fixed in 11.0.23 CVE-2026-55956 MEDIUM EPSS 0% → fixed in 11.0.23 CVE-2026-50229 MEDIUM EPSS 0% → fixed in 11.0.23 CVE-2026-59084 CRITICAL EPSS 0% → see advisoryOther Apache Tomcat versions
Check another release line of Apache Tomcat.
Frequently asked
Is Apache Tomcat 8.5.100 patched?
Apache Tomcat 8.5.100 is end-of-life and no longer receives security patches. Move to 11.0.27.
What version should I upgrade Apache Tomcat 8.5.100 to?
Upgrade Apache Tomcat 8.5.100 to at least 9.0.121 to clear its 16 open critical-or-high vulnerabilities.
When does Apache Tomcat 8.5 reach end-of-life?
Apache Tomcat 8.5 reached end-of-life on 2024-03-31 and no longer receives security patches.
What is the latest version of Apache Tomcat?
The latest supported Apache Tomcat release is 11.0.27.
Is Apache Tomcat 8.5.100 still receiving security updates?
No — Apache Tomcat 8.5.100 is on the 8.5 line, which reached end-of-life on 2024-03-31 and no longer receives security updates. Upgrade to 11.0.27 or later to stay supported.
Informational only, from public data (NVD · CISA KEV · EPSS · endoflife.date), and can lag or miss vendor-specific fixes. Always confirm against Apache's official advisory before you patch or upgrade — Apache Tomcat official site ↗